Check ID: storagegateway_gateway_fault_tolerant
Provider: AWS
Service: storagegateway
Severity: MEDIUM
Categories: resilience
Resource type: Other

​
What this check verifies

AWS Storage Gateway hosted on an EC2 instance is flagged by assessing each gateway’s hosting environment, distinguishing single-instance EC2 deployments from non-EC2 platforms that can leverage platform-level high availability.

​
Risk

A single EC2-hosted gateway concentrates failure risk. Instance or AZ disruption, reboots, or network faults can halt file access, causing downtime and stalled writes. This degrades availability and can affect integrity via partial operations or cache desynchronization.

​
Recommendation

Design for high availability: avoid single-instance gateways for critical workloads. Prefer managed multi-AZ services like EFS or FSx, or use multiple gateways with client failover and resilient naming. Apply defense in depth, validate failover regularly, and monitor health to prevent outages.

​
Remediation

Dashboard steps
  1. In the AWS Console, go to Storage Gateway and click Create gateway
  2. Choose your gateway type, then under Host platform select VMware ESXi, Microsoft Hyper-V, Linux KVM, or Hardware Appliance (do not select Amazon EC2)
  3. Download and deploy the VM on your host, power it on, and note its IP
  4. In the console, connect to and Activate the new gateway
  5. Recreate equivalent resources (shares/volumes/tapes) on the new gateway and update clients to use the new gateway IP/DNS
  6. In Storage Gateway > Gateways, delete the old EC2-hosted gateway
  7. Verify the new gateway’s details show Host platform not equal to Amazon EC2

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = storagegateway_gateway_fault_tolerant. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks